Critical 'BlockStrap' Flaw Threatens Adobe Commerce and Magento Open Source

Businesses utilizing Adobe Commerce and Magento Open Source are at severe and immediate risk due to a critical template engine vulnerability, CVE-2026-103849, known as "BlockStrap," which carries a maximum CVSS v3.1 score of 10.0[1][3][4]. This flaw enables unauthenticated attackers to execute arbitrary code on affected servers[1][3][4].

This vulnerability poses a direct threat to the integrity and security of e-commerce operations. A successful exploit could lead to complete server compromise, the exfiltration of sensitive data, deployment of webshells, and lateral movement within a business's online environment[3]. Given the ease of exploitation, unpatched systems are highly susceptible to malicious activity.

What the records show

Adobe released security update APSB26-153 on October 13, 2026, to address "BlockStrap" and ten other vulnerabilities[1][6][10][11][12][13]. The flaw, CVE-2026-103849, is classified as an improper neutralization of special elements (CWE-1336)[3][4]. It features a low-complexity, network-based attack vector that requires no user interaction or elevated privileges[1][3][4]. At the time of the APSB26-153 release, Adobe reported no known in-the-wild exploitation of "BlockStrap"[1]. However, Sansec researchers reproduced four distinct exploit routes within 24 hours of the patch's availability, indicating a high likelihood of imminent exploitation[2]. The affected versions include various 2.4.x-2026-sep and earlier releases of Adobe Commerce and Magento Open Source, as well as 1.x.x-2026-sep and earlier versions of Adobe Commerce B2B[6][13].

The timeline

Adobe released security update APSB26-92 on August 11, 2026[5]. Exploitation of a separate critical vulnerability, CVE-2026-75650, known as "StyleSmuggler," began on September 4, 2026[7]. Adobe then released APSB26-146 on September 7, 2026, which included a hotfix for CVE-2026-75650[8]. On October 12, 2026, Zynovo published an article discussing issues with insufficient patching[9]. The fix for "BlockStrap" (CVE-2026-103849) arrived with the APSB26-153 security update on October 13, 2026[1][6][10][11][12][13]. Two days later, on October 15, 2026, Sansec researchers successfully reproduced four different exploit methods for "BlockStrap"[2]. Warnings about imminent exploitation of the "BlockStrap" flaw were issued on October 16, 2026[1][14][15][16].

What changed and for whom

Adobe assigned "BlockStrap" a Priority 2 rating, recommending users apply the patch within 30 days[13]. Merchants must update their installations to the October 2026 releases, such as 2.4.4-2026-oct for Adobe Commerce and 2.4.10-alpha1 or later October 2026 releases for Magento Open Source[1][6][13]. Isolated patches are also available for specific versions[1]. It is important to note that APSB26-153 does not include the hotfix for the "StyleSmuggler" vulnerability (CVE-2026-75650), requiring users to apply that hotfix separately and rotate encryption keys and associated credentials[1]. While no official workarounds exist, temporary measures include restricting public exposure of storefronts and administrative interfaces, and blocking external access to relevant API endpoints through Web Application Firewall (WAF) rules[1].

What the subject has said publicly

Adobe has recommended that users apply the APSB26-153 patch within 30 days of its release[13]. The company stated that it had no knowledge of any in-the-wild exploitation of the "BlockStrap" vulnerability at the time of the security update's publication[1].

What we could not confirm

We could not confirm if the temporary mitigation measures suggested by researchers are officially endorsed by Adobe as workarounds[1]. The exact number of Adobe Commerce and Magento Open Source installations that remain unpatched and vulnerable to "BlockStrap" is also unclear. We could not confirm if "BlockStrap" (CVE-2026-103849) has been exploited in the wild since Adobe's October 13, 2026, security update.